765436d4aa3de87af8b390d1cd16fce94c5f72dd04173adbb49c940b98b47704

Analysis

max time kernel
66s
max time network
72s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 01:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

windowsdesktop-runtime-3.1.32-win-x86.exe
Size

46.8MB
MD5

64820bb359e69b81ea680eeb24ca4c22
SHA1

8f0c04ecf97aae2d68354bddf4d1599a6dbc97e9
SHA256

765436d4aa3de87af8b390d1cd16fce94c5f72dd04173adbb49c940b98b47704
SHA512

6b96d2db0d42d06683b6fc2e991193686167d40c85912737705db23dbe8dc7d6b80689ab25201fc0a397c70c463c3fdd40d294e9c47d48b375ff8b7a0a699cf7
SSDEEP

786432:C+ajAAOzYCmKU8agc0eCQHP06ymAPMwNYnp8zHITMp0s5IcmWTNK5TxlOsDsCpxf:IjTOFVU8agcjZHBxAPQp+H2Mp2cmq4XP

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

2 560 msiexec.exe
4 560 msiexec.exe
Executes dropped EXE 2 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exewindowsdesktop-runtime-3.1.32-win-x86.exe

pid process

2016 windowsdesktop-runtime-3.1.32-win-x86.exe
1776 windowsdesktop-runtime-3.1.32-win-x86.exe

flow	pid	process
2	560	msiexec.exe
4	560	msiexec.exe

pid	process
2016	windowsdesktop-runtime-3.1.32-win-x86.exe
1776	windowsdesktop-runtime-3.1.32-win-x86.exe

Loads dropped DLL 7 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exewindowsdesktop-runtime-3.1.32-win-x86.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
1668	windowsdesktop-runtime-3.1.32-win-x86.exe
2016	windowsdesktop-runtime-3.1.32-win-x86.exe
2016	windowsdesktop-runtime-3.1.32-win-x86.exe
948	MsiExec.exe
540	MsiExec.exe
1932	MsiExec.exe
644	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4f894285-fd43-43ac-8669-33e8b7c0a97d} = "\"C:\\ProgramData\\Package Cache\\{4f894285-fd43-43ac-8669-33e8b7c0a97d}\\windowsdesktop-runtime-3.1.32-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-3.1.32-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\zh-Hans\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ja\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\fr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Windows.Presentation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Threading.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\System.Printing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\3.1.32\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.dll	msiexec.exe

Drops file in Windows directory 30 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-3.1.32-win-x86.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\6ce85d.msi	msiexec.exe
File created	C:\Windows\Installer\6ce866.msi	msiexec.exe
File created	C:\Windows\Installer\6ce869.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce869.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3411.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C10.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\6ce861.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce85f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1ABD.tmp	msiexec.exe
File created	C:\Windows\Installer\6ce862.msi	msiexec.exe
File created	C:\Windows\Installer\6ce864.ipi	msiexec.exe
File created	C:\Windows\Installer\6ce870.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce86e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce867.msi	msiexec.exe
File created	C:\Windows\Installer\6ce86b.msi	msiexec.exe
File created	C:\Windows\Installer\6ce86c.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	windowsdesktop-runtime-3.1.32-win-x86.exe
File created	C:\Windows\Installer\6ce85f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce862.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2876.tmp	msiexec.exe
File created	C:\Windows\Installer\6ce867.msi	msiexec.exe
File created	C:\Windows\Installer\6ce85d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce864.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6ce86c.msi	msiexec.exe
File created	C:\Windows\Installer\6ce86e.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe

Modifies registry class 64 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x86\Dependents\{4f894285-fd43-43ac-8669-33e8b7c0a97d}	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x86\Version = "24.192.31915"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\ProductName = "Microsoft .NET Core Host FX Resolver - 3.1.32 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x86\ = "{3C73457A-1A33-4DE0-B6C2-6FBA877E1FCF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x86\ = "{841FE4B1-2C3F-4304-A686-6DF41B4CC1A1}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x86	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4f894285-fd43-43ac-8669-33e8b7c0a97d}\DisplayName = "Microsoft Windows Desktop Runtime - 3.1.32 (x86)"	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\SourceList\PackageName = "windowsdesktop-runtime-3.1.32-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\Version = "415268011"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\87212E0B7785BF8576E5C7E6AB7C498F\1B4EF148F3C240346A68D64FB1C41C1A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C812C11D4C3504077107B2CC3FB81303\A49B5D52DC3E8E44C9A3EF23B0B783CF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{841FE4B1-2C3F-4304-A686-6DF41B4CC1A1}v24.192.31915\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x86\Dependents	windowsdesktop-runtime-3.1.32-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F299A1EC1754D324C9EA11488E2F4917	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\Version = "415268011"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_24.192.31915_x86\Dependents	windowsdesktop-runtime-3.1.32-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C812C11D4C3504077107B2CC3FB81303	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A75437C333A10ED46B2CF6AB78E7F1FC\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E09391BB46561E5FBB8AEF57953D7BF\F299A1EC1754D324C9EA11488E2F4917	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\PackageCode = "12ECD0BB2C8D99D46BD6707139C73F12"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_24.192.31915_x86\Version = "24.192.31915"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x86\Version = "24.192.31915"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CE1A992F-4571-423D-9CAE-1184E8F29471}v24.192.31915\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4f894285-fd43-43ac-8669-33e8b7c0a97d}\ = "{4f894285-fd43-43ac-8669-33e8b7c0a97d}"	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\SourceList\PackageName = "dotnet-runtime-3.1.32-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x86\Dependents\{4f894285-fd43-43ac-8669-33e8b7c0a97d}	windowsdesktop-runtime-3.1.32-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{4f894285-fd43-43ac-8669-33e8b7c0a97d}	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1B4EF148F3C240346A68D64FB1C41C1A\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F299A1EC1754D324C9EA11488E2F4917\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\ProductName = "Microsoft Windows Desktop Runtime - 3.1.32 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A49B5D52DC3E8E44C9A3EF23B0B783CF\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x86\Dependents	windowsdesktop-runtime-3.1.32-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x86	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F299A1EC1754D324C9EA11488E2F4917	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x86\DisplayName = "Microsoft .NET Core Host - 3.1.32 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\SourceList\PackageName = "dotnet-host-3.1.32-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A75437C333A10ED46B2CF6AB78E7F1FC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\PackageCode = "BE32B741C0F4DB94A944AA73E53C1CA5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B4EF148F3C240346A68D64FB1C41C1A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x86\ = "{CE1A992F-4571-423D-9CAE-1184E8F29471}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4f894285-fd43-43ac-8669-33e8b7c0a97d}\Dependents	windowsdesktop-runtime-3.1.32-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A49B5D52DC3E8E44C9A3EF23B0B783CF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F299A1EC1754D324C9EA11488E2F4917\Provider	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

560 msiexec.exe
560 msiexec.exe
560 msiexec.exe
560 msiexec.exe
560 msiexec.exe
560 msiexec.exe
560 msiexec.exe
560 msiexec.exe

pid	process
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe
560	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeIncreaseQuotaPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeSecurityPrivilege	560	msiexec.exe
Token: SeCreateTokenPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeLockMemoryPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeIncreaseQuotaPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeMachineAccountPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeTcbPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeSecurityPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeTakeOwnershipPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeLoadDriverPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeSystemProfilePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeSystemtimePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeProfSingleProcessPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeIncBasePriorityPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeCreatePagefilePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeCreatePermanentPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeBackupPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeRestorePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeShutdownPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeDebugPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeAuditPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeSystemEnvironmentPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeChangeNotifyPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeRemoteShutdownPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeUndockPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeSyncAgentPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeEnableDelegationPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeManageVolumePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeImpersonatePrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeCreateGlobalPrivilege	1776	windowsdesktop-runtime-3.1.32-win-x86.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe
Token: SeRestorePrivilege	560	msiexec.exe
Token: SeTakeOwnershipPrivilege	560	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exe

pid process

2016 windowsdesktop-runtime-3.1.32-win-x86.exe

pid	process
2016	windowsdesktop-runtime-3.1.32-win-x86.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

windowsdesktop-runtime-3.1.32-win-x86.exewindowsdesktop-runtime-3.1.32-win-x86.exemsiexec.exe

description	pid	process	target process
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 1668 wrote to memory of 2016	1668	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 2016 wrote to memory of 1776	2016	windowsdesktop-runtime-3.1.32-win-x86.exe	windowsdesktop-runtime-3.1.32-win-x86.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 948	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 540	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 1932	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe
PID 560 wrote to memory of 644	560	msiexec.exe	MsiExec.exe

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-3.1.32-win-x86.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-3.1.32-win-x86.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\Temp\{0E8D6036-756D-4830-9D4C-4E14F65872B6}\.cr\windowsdesktop-runtime-3.1.32-win-x86.exe
"C:\Windows\Temp\{0E8D6036-756D-4830-9D4C-4E14F65872B6}\.cr\windowsdesktop-runtime-3.1.32-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-3.1.32-win-x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe
"C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe" -q -burn.elevated BurnPipe.{2BE93475-9379-4EEB-9587-9FC9A14DBCBD} {8AC64578-F1DD-4C86-9591-B0922B3DDD00} 2016
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 32B7A431DD27DBAA5FD0ADDBC45649D0
2⤵
- Loads dropped DLL
PID:948

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4746E957DC20B24D3C5C9C244C340EA8
2⤵
- Loads dropped DLL
PID:540

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5416FC89744EF1A01512CED9A4765917
2⤵
- Loads dropped DLL
PID:1932

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7BD129C0D9C252D4BEC1BAD0A72415B2
2⤵
- Loads dropped DLL
PID:644

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c
1⤵
PID:1512

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6ce860.rbs
Filesize
84KB

MD5
3083dac58bded1fa80a3972bbe21e93e

SHA1
aedb508ede39c536c20b8df0df6c09d7ec89d95c

SHA256
af9b5d7d1d26f85940b97f2ceee894557061a3a7dc48c13a461656cddc716619

SHA512
9062e869678f92378e186ef8a27bf79dd0fa9bded296e36ba7e90c53415d6afb4c07b6a602f7418cadcc440177e3847902a03e6cf509c59ae30b18f4ee0e2201

Download Submit
C:\Config.Msi\6ce865.rbs
Filesize
56KB

MD5
dd5ce372979bec61fe4fb85dbad9b25b

SHA1
399effed1d37a8ccdc054a1358399ea15ed6c4e0

SHA256
ec51b05fd2d630c97e175b3f7229f8b73cd6d6b655dd2623befa09dbab0ef917

SHA512
57c6b39382cecbe304d8d7bdbf064cd0ff1b6c8bca7368a833c267b2fb1f5444d722280ca36439f125db2dc7b4598bf907ba378b2c403ec3d388f2692e42f95b

Download Submit
C:\Config.Msi\6ce86a.rbs
Filesize
8KB

MD5
d5748f1b1f9fe62ea591b3e1b22a644e

SHA1
58466b87d8f0a31ffa2d1967c75ddac753e777d7

SHA256
1b6b0e91e094c1f071c48ee0ca1ec6ec9b689f09cfac5f66116ad7fcdcf4d398

SHA512
0191668c91be751e8d9f0c2af74a2cf1e382555dd00e203daea287984e9724df4586f36f253389255902adf33734aac38f390d71bdb6068366bf37b3f1531d0b

Download Submit
C:\Config.Msi\6ce86f.rbs
Filesize
9KB

MD5
de1ea296d80e2e49474e9139c7fc0f9e

SHA1
d5eaddcfc13388943093e5dec32bd7c72eb46188

SHA256
2c45a817c317aeb01536f46d45a566272fec69b93d4a86f76d2b53d1b4e3845a

SHA512
8e10887f4d12588b6be369cf01e0cbcbdc552a3bc5ac556ab5e8715f6875eaba4e7c3eda8d5d37213aef390631164b6e0d314050c4eb09bf38f8235a6c8e1900

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt
Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Filesize
31KB

MD5
3782925318a682b12aecc11fe37cb4d1

SHA1
97adc7d7e8f0fde6fea76e1420c008a8b1b87c7c

SHA256
2e3b2cb5cb57ff44310801dd46e51dab1d35d9cfe196a9709ee8cb9c6f8e4d4a

SHA512
cc99f07fd1971fe732de4bfff4a83be6e10464708e8b37c8b5c2cf840d6ef36e4b29d6f80bcc6ad498859cc92d5ba2265b6e7f408ffdab08cacaea69fcab3929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0fff2e317db2a8b0da2bc8cdfe846870

SHA1
ad865dc10e2c9c5f202e615ec0b6207ca9177950

SHA256
732027503a1442cf79237541fe27686b8e0a276692dd74003d34b1be5d506dec

SHA512
560ce7233fc16fc6d41294ac8aaf0bf066243cfd3f3affba0cee80bb184fcfa18bcccb8a2b21f49a98c13bec8ea17aa754d359275a3d2bfdd671a74730f94c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
605f4993ae5cc0738f6b786817c8ad6b

SHA1
9a036f4217192ab590d18f12b5d9f371bfd459a4

SHA256
9964fde0992d36a1c6172e7545e891d6bf30472154971501282d6419d64b2fd5

SHA512
cbdd4f6de5bd2083eb01572f20586a3652490d7c5d596da7277bd344326f8fd428d92a5848d975914721ff0a5a217b344eaffbc9c5a5abbe17f69edf0d269aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d61ed08df02159ff7cdbb6614b3a3590

SHA1
6c66ee731158fecd29930c5c48d3165644282af8

SHA256
95cf8b400b31cc7c188f1af5e5384416c9993b7d98a8b87df41a70c212329d45

SHA512
66f6d2eba1d28dd5c17a655ce2762d57d285dab7ad46ff39e3db11b85439d99e2c3ac04bd1d35bc6d9836465fb0d00d2afb7f158b9e66c57d2cbecd8e92520c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0E7.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_3.1.32_(x86)_20230412032746_000_windowsdesktop_runtime_3.1.32_win_x86.msi.log
Filesize
2KB

MD5
b5364662ce73e23c4272458ce71480e2

SHA1
cefea8d31470c27f1eb84223b820dfc9fab1bc98

SHA256
59955641ad37f257f70fdb3cd5c30dfd6fd007ac257bbae5a87b9d1db192f159

SHA512
f2321cce5baf2791f52b1aae907272f092bc66c54b2a77a90cd412c9f40c5d131b92e6275e245c3f63c7833cc9c4e32d63ac7ab3071a7cd32785ae67e4c84fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_3.1.32_(x86)_20230412032746_001_dotnet_runtime_3.1.32_win_x86.msi.log
Filesize
2KB

MD5
64137ef4abddb2e7cfbb487eb06a1c8b

SHA1
090392de5594b7a31faf86da64dda2afe8e99dbe

SHA256
39541b75002d4ac451537ef01085890cfad8b9adeb691dc3d54108c2f57fc21f

SHA512
57df2d31376616931b524fd65fc1438e9dee923d2727a6131bb560d187733d3f0638a994e01ab863f8cc721ad33d854f6b534fd497e94f38f1e80d7ee606886b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_3.1.32_(x86)_20230412032746_002_dotnet_hostfxr_3.1.32_win_x86.msi.log
Filesize
2KB

MD5
f4ea2092f69a6a209513420ce860f7b7

SHA1
8c4c4d3708417021fbb9aba2bc84f52b3eac3d3b

SHA256
4c62125bf429715cde189a9042e9d9e5bdf851d46bab40d56c58337fa959f5c4

SHA512
068c4cbcd9e07c154ef5f3b7a8bfe04a95cc0ab6ad82f4c2c5c51be45f15559b04c5287e22c9d4895e3a230f02e42fde3b387a5352f9512d2b923abfaac17598

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_3.1.32_(x86)_20230412032746_003_dotnet_host_3.1.32_win_x86.msi.log
Filesize
2KB

MD5
4a40c36d61b232662bc3d4499085be87

SHA1
e191a36bd1e8bf727a2a3ccb51b810d052d2ff25

SHA256
9add662207f777f8fdcb5752c4b71fe0d003f478754a87aa4813a48302076495

SHA512
0b3368dd08a60ba36f48a2109046edaa5e2a944e62be9a888ced22a8d3631014c48832d57c081d6adb71f8253985b8cc9d280ad2e405a6dd3aa0761e7786550d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0F9.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF306.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Windows\Installer\6ce861.msi
Filesize
24.8MB

MD5
cb032fbbc59b042eed0368c1e2596666

SHA1
f3ea98f8e04fd3909529e8d0d75dd96157ed3978

SHA256
c6f207b164b959751120eee3a05eb889e443dcdc32b3e34e83b40905a386d7bf

SHA512
c34896c448f1da4684cf73293290d2d96a4f238fb7f78beda164e11e470329334dc01f9fa821e3656bf2f10232781301fac44f16036014b3fc07c2414315a74c

Download Submit
C:\Windows\Installer\6ce866.msi
Filesize
21.6MB

MD5
d53f737da711a9d06ea465e663551658

SHA1
95b85f8a0dfa3797d7bd727174290ca97d34d4dc

SHA256
7383b3607be9f6c593351d525d0c36c179d22ebd152904fb91f88eafbdf999b1

SHA512
fe5133279b6d360166014a7a15b25dec9202cc15de82eb4fabda6dfca027ae320642496dec01c1c6818f97b14ff82d127e054c9007b7080a996c10d972e66d21

Download Submit
C:\Windows\Installer\6ce867.msi
Filesize
788KB

MD5
40fffa90828197d126b9a4feeac9dd1d

SHA1
ad983a57a3426a71fde87a530398f2aefb2dc2ce

SHA256
5fb17faf4bd9040a3a694d647ad97aa718bfc8dfd149d1190cac117b45b6a50d

SHA512
fb9c026b6fd6d93c0611ddc5d2529ccb4e31bba7a3230fd3cf8573cadfc6c97414b0ee459f6a8a90764035225ad8602603876219108d37bf32244203779ff2e5

Download Submit
C:\Windows\Installer\MSI2876.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3411.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3411.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3D6A.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI8DF.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{0E8D6036-756D-4830-9D4C-4E14F65872B6}\.cr\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
C:\Windows\Temp\{0E8D6036-756D-4830-9D4C-4E14F65872B6}\.cr\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.ba\bg.png
Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\dotnet_host_3.1.32_win_x86.msi
Filesize
724KB

MD5
1628a37402f2d197c829602049e0a888

SHA1
e2779dfd4580e5a1a5fbd4b59279a61baf65b128

SHA256
5087395b278ac32c444a20b2237591240bf34335921506db58df4256a9ddfadd

SHA512
2189bf85a3cee253828e97b3686c3bf5537628a70662a7427aeaf0439fd2c191c4cbd101e144379daf3e76f60809c04dc27516c736c4b4944c31479aea6a384d

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\dotnet_hostfxr_3.1.32_win_x86.msi
Filesize
788KB

MD5
40fffa90828197d126b9a4feeac9dd1d

SHA1
ad983a57a3426a71fde87a530398f2aefb2dc2ce

SHA256
5fb17faf4bd9040a3a694d647ad97aa718bfc8dfd149d1190cac117b45b6a50d

SHA512
fb9c026b6fd6d93c0611ddc5d2529ccb4e31bba7a3230fd3cf8573cadfc6c97414b0ee459f6a8a90764035225ad8602603876219108d37bf32244203779ff2e5

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\dotnet_runtime_3.1.32_win_x86.msi
Filesize
21.6MB

MD5
d53f737da711a9d06ea465e663551658

SHA1
95b85f8a0dfa3797d7bd727174290ca97d34d4dc

SHA256
7383b3607be9f6c593351d525d0c36c179d22ebd152904fb91f88eafbdf999b1

SHA512
fe5133279b6d360166014a7a15b25dec9202cc15de82eb4fabda6dfca027ae320642496dec01c1c6818f97b14ff82d127e054c9007b7080a996c10d972e66d21

Download Submit
C:\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\windowsdesktop_runtime_3.1.32_win_x86.msi
Filesize
24.8MB

MD5
cb032fbbc59b042eed0368c1e2596666

SHA1
f3ea98f8e04fd3909529e8d0d75dd96157ed3978

SHA256
c6f207b164b959751120eee3a05eb889e443dcdc32b3e34e83b40905a386d7bf

SHA512
c34896c448f1da4684cf73293290d2d96a4f238fb7f78beda164e11e470329334dc01f9fa821e3656bf2f10232781301fac44f16036014b3fc07c2414315a74c

Download Submit
\Windows\Installer\MSI2876.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI3411.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI3D6A.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI8DF.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{0E8D6036-756D-4830-9D4C-4E14F65872B6}\.cr\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.ba\wixstdba.dll
Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{D6526A6D-A8BC-4EBE-BE01-1BC587536153}\.be\windowsdesktop-runtime-3.1.32-win-x86.exe
Filesize
607KB

MD5
573c9d0095bdf8d8ce3d4fcf6ff8235a

SHA1
95183b4795681d06f487f8d4e458537383c7392f

SHA256
1d52b200bf32d43fdeeee00e0eaa5710dfc706f5c45a6b880f029369dcbae54b

SHA512
ab6924c16806d21be2ede17f144c05d7b4e608659fd0b509db3ff0e4a512c126683de9e4860ecfed8df011c1febea0bd922520b2e22aead723bb18d5a9720688

Download Submit
memory/1052-1113-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/1932-1114-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads